Add audit logs.

API/ROLAC.API/Services/PermissionService.cs

@@ -1,9 +1,12 @@
+using System.Security.Claims;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Caching.Memory;
 using ROLAC.API.Authorization;
 using ROLAC.API.Data;
 using ROLAC.API.DTOs.Permissions;
 using ROLAC.API.Entities;
+using ROLAC.API.Entities.Logging;
+using ROLAC.API.Services.Logging;
 
 namespace ROLAC.API.Services;
 
@@ -36,11 +39,19 @@ public class PermissionService : IPermissionService
 
     private readonly IServiceScopeFactory _scopeFactory;
     private readonly IMemoryCache         _cache;
+    private readonly SystemLogQueue       _logQueue;
+    private readonly IHttpContextAccessor _http;
 
-    public PermissionService(IServiceScopeFactory scopeFactory, IMemoryCache cache)
+    public PermissionService(
+        IServiceScopeFactory scopeFactory,
+        IMemoryCache         cache,
+        SystemLogQueue       logQueue,
+        IHttpContextAccessor http)
     {
         _scopeFactory = scopeFactory;
         _cache        = cache;
+        _logQueue     = logQueue;
+        _http         = http;
     }
 
     public async Task<bool> HasPermissionAsync(IEnumerable<string> roles, string module, string action)
@@ -174,6 +185,24 @@ public class PermissionService : IPermissionService
 
         await db.SaveChangesAsync();
         Invalidate();
+
+        // Singleton service can't use the scoped IAuditLogger — enqueue directly.
+        var user = _http.HttpContext?.User;
+        _logQueue.TryEnqueue(new AuditLog
+        {
+            Timestamp     = DateTimeOffset.UtcNow,
+            Level         = LogLevelEnum.Warning,
+            Action        = AuditActions.PermissionChanged,
+            Category      = AuditCategories.Security,
+            EntityName    = "Role",
+            EntityId      = roleName,
+            Summary       = $"Permissions updated for role '{roleName}'",
+            Changes       = AuditChangeSerializer.BuildChanges(null, new { Role = roleName, Modules = rows }),
+            UserId        = user?.FindFirstValue(ClaimTypes.NameIdentifier) ?? user?.FindFirstValue("sub"),
+            UserEmail     = user?.FindFirstValue("email"),
+            IpAddress     = _http.HttpContext?.Connection.RemoteIpAddress?.ToString(),
+            CorrelationId = _http.HttpContext?.TraceIdentifier,
+        });
     }
 
     public void Invalidate() => _cache.Remove(CacheKey);